Phone Cloning or Wi-Fi Theft how do you catch/identify who the culprit is?

Well I certainly believe that phone cloning is possible not that I've seen it (and wish I could do it myself for personal use so I could have one number ring two phones like you could do in the old days when you pluged in a second wired phone ). I don't believe that's the case from what it sounds like, sounds to me more like they've had their Facebook accounts hacked which then sends new Messages as text messages notifications to there phone number. if that's the case they should be using a stronger password on their Facebook preferably unique to each site they visit and use something like lastpass to remember it. they need to clean out any apps and games (and possibly friends they don't know) they've used on Facebook. ( I had an experience Way-back when with an IQ test that gave me a free game, however it was free because it started charging me on my AT&T bill for a monthly subscription). and they need to reset the security questions to something that's not public knowledge a.k.a. write down random answers and keep them in a safe place because it's very easy to find out what somebody's mothers maiden name is these days.

I'm a young guy but I still loved my flip phone, until it had a slight accident....

on another note
I had recently received a new number for a mobile data device and because of phone number recycling. The previous person who had it must've signed up for notifications from Facebook, however they must've signed up for the Spanish version. I had to use my back up phone to reply "STOP" to the message as the data Device did not have text message capability apart from incoming service SMS messages.
So it is also possible that they are getting automated messages sent to their phones as SMS and if that's the case they need to reply "stop" in that message and that will stop them supposedly if they're coming from an honest company.

Then there's the issue of Wi-Fi and computers. so there's a reputable story that I know of where a lady had a legitimate antivirus software that the company lost control of there encryption key for their web address. That then allowed attackers to impersonate. them and then use it in software to loop all data through them where they then had access to the encrypted data and passwords between her and Facebook. which allowed them to post obscene material on this person's Facebook.

So if they're worried about the Computer side of things. I would recommend that they get a USB key or drive and back up all the files and documents (and if you don't have them elsewhere your product keys) and do a factory restore to their computer. install all updates and software. Scan with a good antivirus software the back up and then move their date it back. because I would suspect that they haven't done that since they got the computer, and that's the best way to more or less make sure it's safe assuming you don't bring back an infected file or an infected program from the back up.

I hope that was helpful.
I don't necessarily expect to get back here very soon as I have issues with the AT&T site on my older computer.